Bug 135084 - Crash on undo ucrtbase abort
Summary: Crash on undo ucrtbase abort
Status: NEW
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: Writer (show other bugs)
Version:
(earliest affected)
4.4.0.3 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords: bibisectRequest, regression
: 131804 135414 (view as bug list)
Depends on:
Blocks: Crash
  Show dependency treegraph
 
Reported: 2020-07-23 21:05 UTC by Telesto
Modified: 2021-10-04 00:50 UTC (History)
3 users (show)

See Also:
Crash report or crash signature:
Regression By:


Attachments
Example file (10.43 KB, application/vnd.oasis.opendocument.text)
2020-07-23 21:06 UTC, Telesto
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Telesto 2020-07-23 21:05:52 UTC
Description:
Crash on undo ucrtbase abort

Steps to Reproduce:
1. open the attached file
2. Insert a chart
3. Delete chart
4. CTRL+A
5. Backspace
6. CTRL+Z
7. CTRL+Z

Actual Results:
Crash

Expected Results:
No crash


Reproducible: Always


User Profile Reset: No



Additional Info:
Found in
Version: 7.1.0.0.alpha0+ (x64)
Build ID: 52820b52b3bca45e2db527d1cc5f4488b2e0b9d0
CPU threads: 4; OS: Windows 6.3 Build 9600; UI render: Skia/Raster; VCL: win
Locale: nl-NL (nl_NL); UI: en-US
Calc: CL

6.0

4.4.7.2

not in 
Version: 4.3.0.4
Build ID: 62ad5818884a2fc2e5780dd45466868d41009ec0
Comment 1 Telesto 2020-07-23 21:06:12 UTC
Created attachment 163462 [details]
Example file
Comment 2 Telesto 2020-07-23 21:34:08 UTC
*** Bug 131804 has been marked as a duplicate of this bug. ***
Comment 3 Dieter 2021-03-28 09:59:03 UTC
Telesto, it seems, that nobody could confirm this bug since more than one year. So Iā€˜d like to ask, if it is still reproducible for you. Could you please try to reproduce it with a master build from http://dev-builds.libreoffice.org/daily/master/current.html? I have set the bug's status to 'NEEDINFO'. Please change it back to 'UNCONFIRMED' if the bug is still present in the latest version.
Comment 4 QA Administrators 2021-09-26 03:57:55 UTC Comment hidden (obsolete)
Comment 5 raal 2021-10-02 09:40:59 UTC
I can reproduce crash with Version: 7.3.0.0.alpha0+ / LibreOffice Community
Build ID: b63c5ade3554a42def4bce94f9fd67ea66528214
CPU threads: 4; OS: Linux 5.11; UI render: default; VCL: gtk3
Locale: cs-CZ (cs_CZ.UTF-8); UI: en-US
Calc: threaded
Comment 6 raal 2021-10-02 10:05:53 UTC
This seems to have begun at the below commit.
Adding Cc: to XXX ; Could you possibly take a look at this one?
Thanks
 0918a0c29b494e043480b9f1ed3f032524968d59 is the first bad commit
commit 0918a0c29b494e043480b9f1ed3f032524968d59
Author: Matthew Francis <mjay.francis@gmail.com>
Date:   Sun Mar 15 03:51:36 2015 +0800

    source-hash-47a2d7642d249d70b5da0c330a73f3a0032e4bba
    
    commit 47a2d7642d249d70b5da0c330a73f3a0032e4bba
    Author:     Juan Picca <jumapico@gmail.com>
    AuthorDate: Fri Sep 19 14:19:30 2014 -0300
    Commit:     David Tardon <dtardon@redhat.com>
    CommitDate: Thu Oct 9 11:33:33 2014 +0000
    
        fdo#81356: convert Fraction to boost::rational<long> - wip
    
        * Added rational util functions used by Fraction class not
          available in the boost::rational class.
        * Replaced usage of Fraction by boost::rational<long>
        * Removed code that relies on:
          1. fraction.IsValid() -- rational only allow valid values, ie
             denominator() != 0
          2. rational.denominator() == 0 -- always false
          3. rational.denominator() < 0 -- always false but implementation
             detail: http://www.boost.org/doc/libs/release/libs/rational/rational.html#Internal%20representation
        * Simplified code that relies on:
          1. rational.denominator() != 0 -- always true
        * BUGS EXIST because Fraction allows the creation of invalid values but
          boost::rational throws the exception boost::bad_rational
Comment 7 raal 2021-10-02 10:06:47 UTC
Adding Cc: to Juan Picca
Comment 8 raal 2021-10-02 14:36:54 UTC
*** Bug 135414 has been marked as a duplicate of this bug. ***
Comment 9 Juan Picca 2021-10-03 03:26:38 UTC
Hi all.

1. I can't reproduce the bug in 

Version: 7.2.1.2 / LibreOffice Community
Build ID: 20(Build:2)
CPU threads: 4; OS: Linux 5.14; UI render: default; VCL: gtk3
Locale: es-UY (en_US.UTF-8); UI: en-US
Debian package version: 1:7.2.1-4
Calc: threaded

2. The mentioned commit was reverted:

commit 31af61ea091cc895b893c849f2130aa35792b7db                                  
Author: Jan Holesovsky <kendy@collabora.com>                                     
Date:   Thu Oct 23 17:41:47 2014 +0200                                           
                                                                                 
    Fraction: Revert "fdo#81356: convert Fraction to boost::rational<long> - wip"
                                                                                 
    This reverts commit 47a2d7642d249d70b5da0c330a73f3a0032e4bba.                
                                                                                 
    Conflicts:                                                                   
                                                                                 
            cui/source/tabpages/transfrm.cxx                                     
            svx/source/svdraw/svdedtv1.cxx                                       
            svx/source/svdraw/svdibrow.cxx                                       
            sw/source/filter/ww1/w1filter.cxx                                    
            tools/source/generic/rational.cxx                                    
                                                                                 
    Change-Id: I4849916f5f277a4afef0e279b0135c76b36b9d15

Regards,
JMPC
Comment 10 raal 2021-10-03 07:40:11 UTC
I can reproduce the crash with LO 7.3. There is message in CLI 
terminate called after throwing an instance of 'boost::wrapexcept<boost::bad_rational>'
  what():  bad rational: zero denominator
Comment 11 Juan Picca 2021-10-04 00:50:14 UTC
Hi raal.

It is possible for you run writer under gdb to obtain a stack trace?
I suspect that the problem is with the code that try to create an invalid fraction (zero denominator).

Maybe we can add a check before the creation of the fraction.

Greetings,
JMPC